EUVD-2026-35292
GHSA-qpcq-fxp5-fvp9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled the non-default 'Parse Vimeo and YouTube links' (parse_comments) plugin setting, and requires a submitted comment to be approved by an administrator before the payload is publicly delivered.
Articles & Coverage 2
AnalysisAI
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin (versions through 7.5.49.7212) allows remote attackers to inject persistent JavaScript via the comment text field, which executes in any visitor's browser when the affected page is loaded. The flaw stems from insufficient input sanitization and output escaping in the comment-parsing routine and is reachable only when the non-default 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and an administrator approves the malicious comment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both hold: (1) the site administrator must have enabled the non-default 'Parse Vimeo and YouTube links' setting (parse_comments) in the FV Flowplayer Video Player plugin, and (2) an administrator must manually approve the attacker's malicious comment before it is rendered to visitors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects network-reachable, unauthenticated submission with no user interaction and a changed scope (typical of stored XSS that affects other users' browser sessions), but the impact is bounded to low confidentiality/integrity and no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a comment containing a crafted payload disguised as a Vimeo or YouTube link on a post belonging to a WordPress site that uses the FV Flowplayer Video Player plugin with parse_comments enabled. A site administrator, seeing what looks like a normal video-link comment, approves it; the plugin then renders the unsanitized content into the public page, and the injected JavaScript executes in every visitor's browser - including any logged-in admin who later views the page - enabling session hijacking, forced admin actions via CSRF, or redirection to attacker infrastructure. |
| Remediation | Upgrade the FV Flowplayer Video Player plugin to a release later than 7.5.49.7212; the Trac changeset referenced in the advisory (https://plugins.trac.wordpress.org/changeset?new=3522496%40fv-wordpress-flowplayer%2Ftrunk&old=3478883%40fv-wordpress-flowplayer%2Ftrunk) shows the upstream fix, but a specific tagged patched version is not independently confirmed from the supplied data, so verify the latest version on the WordPress.org plugin page before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Verify plugin installation and check whether 'Parse Vimeo and YouTube links' setting is enabled; review recent comment activity for suspicious content. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that i
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticat
The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline
Remote code execution in Edgar Rojas WooCommerce PDF Invoice Builder WordPress plugin (versions through 2.0.8) allows un
Share
External POC / Exploit Code
Leaving vuln.today